MCSB NS-1: Network Security
25 Senserva Microsoft 365 security checks provide evidence for Microsoft Cloud Security Benchmark control NS-1 (Network Security). Each is checked against your tenant, ranked by Severity, with validated remediation.
Senserva provides Three Free Unlimited Audits, including all tenants and full Claude MCP.Start my Audit
What MCSB NS-1 covers
The Microsoft Cloud Security Benchmark is Microsoft's own security baseline for Azure and Microsoft 365, organized into control domains. NS-1 sits in the Network Security domain. Senserva evidences it with the 25 checks below, so you can see, per tenant, whether the control is actually met rather than assumed.
Ask your own AI about this control
Copy this prompt into Claude, ChatGPT, or Copilot. The facts are included, sourced from this page.
The 25 checks that evidence MCSB NS-1
Click any row for why it matters and how to fix it, with a link to the full check page.
| Senserva check | Severity | What it verifies |
|---|---|---|
| Internet Facing VM Protected By Nsg | High | Internet-facing VM is protected by a Network Security Group (NSG) |
| Intune Policy Firewall Domain Network Default Inbound Action | High | Windows Firewall default inbound action for Domain network is not set to Block |
| Intune Policy Firewall Domain Network Enablement | High | Windows Firewall is not enabled for Domain network profile |
| Intune Policy Firewall Private Network Default Inbound Action | High | Windows Firewall default inbound action for Private network is not set to Block |
| Intune Policy Firewall Private Network Enablement | High | Windows Firewall is not enabled for Private network profile |
| Intune Policy Firewall Public Network Default Inbound Action | High | Windows Firewall default inbound action for Public network is not set to Block |
| Intune Policy Firewall Public Network Disabled Inbound Action Notifications | High | Windows Firewall inbound action notifications not disabled for Public network |
| Intune Policy Firewall Public Network Enablement | High | Windows Firewall is not enabled for Public network profile |
| Intune Policy Firewall Public Network IP Sec Merge | High | IPsec exemptions are allowed on Public network profile |
| Intune Policy Firewall Public Network Local Policy Merge | High | Local firewall policy merge is enabled on Public network profile |
| Intune Policy Firewall Public Network Log Dropped Packets | High | Windows Firewall is not configured to log dropped packets on Public network |
| Intune Policy Firewall Domain Network Disabled Inbound Action Notifications | Medium | Windows Firewall inbound action notifications are not disabled for Domain network |
| Intune Policy Firewall Domain Network Log Dropped Packets | Medium | Windows Firewall is not configured to log dropped packets on Domain network |
| Intune Policy Firewall Private Network Log Dropped Packets | Medium | Windows Firewall is not configured to log dropped packets on Private network |
| Intune Policy Firewall Property Not Found | Medium | Expected firewall property was not found in the Intune policy configuration |
| Network Flow Logs Configured | Medium | TODO: Network flow logs configuration check. Not yet implemented |
| Non Internet Facing VM Protected By Nsg | Medium | Non-internet-facing VM is protected by a Network Security Group (NSG) |
| Nsg Flow Logs Enabled | Medium | NSG flow logs are enabled for network traffic monitoring and forensics |
| Intune Policy Firewall Private Network Disabled Inbound Action Notifications | Low | Windows Firewall inbound action notifications are not disabled for Private network |
| Intune Policy Firewall Domain Network Log Max File Size | Info | Windows Firewall log file size for Domain network is below recommended threshold |
| Intune Policy Firewall Domain Network Log Successful Connections | Info | Windows Firewall is not configured to log successful connections on Domain network |
| Intune Policy Firewall Private Network Log Max File Size | Info | Windows Firewall log file size for Private network is below recommended threshold |
| Intune Policy Firewall Private Network Log Successful Connections | Info | Windows Firewall is not configured to log successful connections on Private network |
| Intune Policy Firewall Public Network Log Max File Size | Info | Windows Firewall log file size for Public network is below recommended threshold |
| Intune Policy Firewall Public Network Log Successful Connections | Info | Windows Firewall is not configured to log successful connections on Public network |
Also evidences
The same checks provide evidence for these frameworks, so one fix counts across your obligations:
Evidence this control in your own Microsoft 365
This page maps Microsoft Cloud Security Benchmark control NS-1 (Network Security) to the checks that prove it. Siemserva by Senserva runs those checks, and 650+ others, against your own tenant: it shows exactly where this control is met or failing, ranks the gaps by Severity, and produces the audit-ready evidence and validated fixes to close them.
Built for the people who own this outcome: security and IT teams closing gaps, auditors and compliance teams gathering evidence, and MSPs and MSSPs running it across every client tenant.
Every MCSB control and the checks that evidence it: the control reference. The full benchmark crosswalk: MCSB for Microsoft 365.